PKIUtil is a utility class, which has not been properly decomposed to API/service and therefore it leads to Bouncy Castle being leaked to all users of aaa-encrypt-service.
While we could easily extract its interface and make it a component, there is only a single user, NETCONF's netconf-topology. That user has chosen to inline the functionality it needs.
Remove PKIUtil to fix the class path leak.